PT-2016-1235 · Microsoft · Sharepoint Foundation 2013 Sp1+1

Publicado 2016-02-09 · Atualizado 2018-10-12 · CVE-2016-0039

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2013 SP1

Description A cross-site scripting (XSS) issue exists due to inadequate protection of the web page structure, allowing remote attackers to inject arbitrary web script or HTML via a crafted request. This can be exploited by an authenticated attacker sending a specially crafted request to an affected SharePoint server, potentially leading to cross-site scripting attacks. These attacks could enable the attacker to read unauthorized content, use the victim's identity to take actions on the SharePoint site, and inject malicious content into the victim's browser.

Recommendations For Microsoft SharePoint Foundation 2013 SP1, apply the necessary security updates to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the SharePoint site and implementing additional security measures to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2016-00496

CVE-2016-0039

Produtos afetados

Sharepoint Foundation 2013 Sp1

Sharepoint Foundation

Referências · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0039 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0039 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00496 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS16-015 · Nota
• http://securitytracker.com/id/1034975 · Nota